Before you start

For key information about SAML in Sumo, see the Limitations section of the "Set Up SAML for Single Sign-On" page.

Configure SSO for a Custom App

Log into the Google Admin Console.

Select Apps > SAML Apps.

Select a new SAML app to be configured, or click the + at the bottom of the page.

On the Enable SSO for SAML Application page, select Setup my own Custom App at the bottom of the page.

The Google IdP Information page appears. Make note of the following URLs, as you will supply them when you configure SAML in Sumo:

SSO URL

Entity ID

Click Download for the Certificate.

Click Next.

In Basic Information for your Custom App page, enter the following:

Application Name. Enter Sumo Logic.

Description. Sumo Logic is the industry's leading, secure cloud-based log monitoring, management and analytics service that leverages big data for real-time IT insights.

Upload Logo. Use sumologic.png

Click Next.

Configure Sumo Logic SAML

In the Sumo web app, go to Administration > Security > SAML.

Click the plus (+) icon to create a new configuration.

In the Add Configuration page, enter the following details:

Configuration Name. Google Apps Auth (or, you can enter any name you like).

Debug Mode. Not required. Activating this setting now is useful for troubleshooting later. Select this option if you'd like to view additional details if an error occurs when a user attempts to authenticate. For more information, see View SAML Debug Information.

Issuer. Enter the Entity ID from the Google IdP Information dialog.

X.509 Certificate. Open the certificate file that you downloaded from the Google IdP Information dialog in a text editor. Copy and paste the contents into this field.

Attribute Mapping: Select Use SAML attribute and type the email attribute name in the text box.

SP Initiated Login Configuration: Click this option. A Login Path field appears. Enter a unique identifier for your org. You can specify any alphanumeric string (with no embedded spaces), provided that it is unique to your org. (You can't configure a Login Path that another Sumo customer has already configured). The identifier is used to generate a unique URL for user login. For example, if you enter "yourcompanyname", the login URL for the HTTP redirect binding will be:

where deployment is your specific deployment: us2|eu|au
If you enter a Login Path that is not unique across all Sumo orgs, Sumo issues this error: SP Initiated login path in use. Please enter a different path.

Disable Requested Authn Context. If you check this option, Sumo will not include the RequestedAuthnContext element of the SAML AuthnRequests it sends to your Idp. This option is useful if your IdP does not support the RequestedAuthnContext element

Roles Attribute: When you click this option, Roles Attribute field appears. Enter the SAML Attribute Name that is sent by the IdP as part of the assertion. For details, see Set Up SAML for Single Sign-On.

On-Demand provisioning. Select this option and specify the following attributes to have Sumo Logic automatically create accounts when a user first logs on. For more information, see Set Up SAML for Single Sign-On.

First Name Attribute. FirstName

Last Name Attribute. LastName

On-Demand Provisioning Roles. Analyst

Logout Page: Select this option and enter a URL if you'd like to point all users to the URL after logging out of Sumo Logic. For more information, see Set Up SAML for Single Sign-On.

Click Add.

To view the details of your configuration, select it the Configuration List. The right side of the page displays the following information. You'll need to provide one of these URLs when you configure settings for your IdP.

SP Initiated (Redirect & POST values)

Authentication Request

Assertion Consumer

Complete the Google SAML App Configuration

Go Back to the Google Auth Configuration – Service Provider Details dialog, and enter the following information:

ACS URL. This is the Assertion Consumer from Sumo Logic

Entity ID. Enter the URL you use to access Sumo Logic, for example:
https://service.sumologic.com

Name ID. Basic Information – Primary Email

Name ID Format. EMAIL

Click Next.

In the Attribute Mapping dialog, make the following selections:

FirstName. Select Basic Information and First Name.

LastName. Select Basic Information and Last Name.

Email. Select Basic Information and Primary Email.

Click Finish.

The Settings for Sumo Logic page is displayed, and you should see the success message Setting up SSO for Sumo Logic. Click OK.

To enable the Sumo Logic App for everyone, from the menu, select On for everyone.

After a short delay, the new Sumo Logic SAML App will be displayed in your Google Apps login menu.

Create Multiple SAML Configurations

You can create multiple SAML configurations in Sumo. To create an additional SAML configuration, click the plus (+) icon to create a new configuration. Enter the settings for the new configuration, as described the previous section.

Check SAML Usage

If you intend to require Sumo users to sign-in using SAML, as described in the following section, Require SAML for sign-in, it is a best practice to first check whether some users are still logging in directly, instead of using SAML. You can run the following query to see, for a particular time range, whether users signed in using SAML or with their username and password:

_index=sumologic_audit action=login | count by class, sourceuser

This query depends upon data in the Sumo audit index. If the audit index is not enabled, the query will not return results. To enable the index, follow the instructions in Enable and Manage the Audit Index.

The query results show, for each user that has accessed Sumo over the time range, the number of times they have logged in using SAML or by entering a Sumo username and password. In the class column:

"SAML" indicates the user signed in using SAML.

"SESSION" indicates the user authenticated by entering a username and password.

If the same user accessed Sumo using both methods (SAML and direct logon) during the time range, the query results will include a row for each method, showing how many times each method was used.

Require SAML for sign-in

After you create a SAML configuration, you can require users to sign in using SAML and prevent users from bypassing SAML with a username and password for login. Before you do so, follow the instructions in Check SAML Usage.

Click Require SAML Sign In to require users to sign in using SAML.

After you lock down SAML, any new users you whitelist will have to select Forgot Password from the login screen to recover their credentials. This is because a SAML-locked down user does NOT have a password.

Sumo automatically adds your account under Allow these users to sign in using passwords in addition to SAML as a whitelisted user as a preventative measure to ensure you’re still able to access Sumo if you run into issues.

Having only one user able to bypass SAML may not be convenient or practical if you have a global company or a large team. You can add additional whitelisted users by clicking the (+) icon by Allow these users to sign in using passwords in addition to SAML:

We do not recommend denying all users password access to Sumo even if you want to enforce log in by SAML. If you attempt to delete your last remaining whitelisted user, you will receive a warning that this is not a recommended practice:

SAML lockdown and user login email address updates

Once you configure Sumo to require users to use SAML for signing into Sumo, you will be unable to change a user's login email address. To change a user's login email address, you must toggle off the Require SAML Sign In option, change the password, and then turn Require SAML Sign In back on.

Recommended articles

Sumo Logic is the industry’s leading secure, cloud-native, machine data analytics service, delivering real-time, continuous intelligence across the entire application lifecycle and stack. More than 1,000 customers around the globe rely on Sumo Logic for the analytics and insights to build, run and secure their modern applications and cloud infrastructures.